Support multi-source provider icon packs

[konojunya]

Summary

• add a backward-compatible provider-pack 1.1 contract for additional audited archives
• retain 1.0 single-source pack support and record per-icon source references
• preserve optional per-icon brand source and guideline URLs in manifests and notices
• record safe decimal view-box normalization as a visual-preservation transformation
• validate duplicate and unresolved source IDs across JSON Schema, JavaScript, Rust, and TypeScript artifacts
• prepare the 0.5.0 theme release

Validation

• npm run validate
• npm test
• npm run typecheck
• npm run generate:check
• cargo test --locked
• cargo clippy --all-targets --all-features --locked -- -D warnings
• RUSTDOCFLAGS=-D warnings cargo doc --no-deps --locked
• git diff --check

No provider artwork is included in this repository or its generated packages.